CGOA Practice Test 23 — 15 Questions

Question 1

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

Accepted Answer

Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.. Using a tool like Crossplane or an orchestrator ensures that infrastructure and applications are synchronized through the same Git-based reconciliation loop.

Answer

Execute Terraform via a CI job that triggers Argo CD after completion.

Answer

Manually trigger Terraform runs before pushing new app manifests to Git.

Answer

Embed Terraform binary execution within a K8s deployment container.

Question 2

Which TWO of the following are common pitfalls when integrating DevSecOps into a GitOps pipeline?

Accepted Answer

Skipping vulnerability scans for Kubernetes manifests.. Failing to scan the manifests in the pipeline and leaving secrets in plain text are common GitOps security failures.

Answer

Using multiple branches in Git.

Answer

Setting up an automated reconciliation operator.

Answer

Automating the deployment of code changes.

Question 3

Why do you use a separate repository for application code and application manifests (deployment manifests) in GitOps?

Accepted Answer

To allow different teams to manage code and configuration independently and securely.. Separating the source code from the environment configuration allows for independent lifecycle management and improved security scoping.

Answer

It is required by the Kubernetes specification.

Answer

Because they are written in different languages.

Answer

It makes the CI/CD pipeline run faster.

Question 4

When implementing GitOps, what is the 'GitOps Operator' pattern specifically meant to solve?

Accepted Answer

It eliminates the need for any manual interaction with the cluster.. The operator pattern solves the problem of drift by constantly reconciling the running state of the cluster with the desired state stored in version control.

Answer

It automates the building of Docker images.

Answer

It replaces the need for a Git repository.

Answer

It provides a user interface for cluster management.

Question 5

When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?

Accepted Answer

It makes rollbacks impossible because the 'latest' image may be different than what was deployed.. The 'latest' tag is mutable, meaning it can point to different code at different times, violating the GitOps principle of deterministic, reproducible deployments.

Answer

It causes high latency in the cluster.

Answer

The GitOps operator cannot detect changes.

Answer

It consumes too much disk space.

Question 6

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

Accepted Answer

A user performed a manual 'kubectl' command to modify a deployment.. Flux reconcilers periodically verify the cluster state; drift usually occurs when an external actor modifies the cluster directly or a manual change occurred.

Answer

The container registry is unreachable during a new image rollout.

Answer

The Git repository contains syntax errors in the YAML files.

Answer

The CI pipeline failed to run tests.

Question 7

You are migrating a legacy application deployment process to GitOps. The application requires a specific sequence of database migrations to run before the new container version is deployed. How do you implement this in a GitOps-friendly way?

Accepted Answer

Use a Kubernetes 'Job' resource that runs before the Deployment, and manage dependencies with initContainers or Helm hooks.. GitOps relies on reconciliation. Pre-deployment tasks should be managed via Kubernetes Jobs or hooks that maintain the declarative nature of the cluster state.

Answer

Add a 'kubectl apply' command to the end of the CI pipeline to execute migrations.

Answer

Hardcode the migration logic into the application source code to run on startup.

Answer

Create a manual trigger in the GitOps dashboard to execute the migration after the deployment starts.

Answer

Configure the GitOps agent to execute a shell script on the node before pulling the image.

Question 8

What is the key difference between Configuration as Code and Infrastructure as Code in the context of GitOps?

Accepted Answer

IaC defines the underlying resources, while Config as Code defines the application-level settings.. Infrastructure as Code focuses on the underlying environment (VMs, networks), while Configuration as Code focuses on the software services and their settings.

Answer

Configuration as Code is only for databases.

Answer

Config as Code is always written in YAML.

Answer

They are the same thing.

Question 9

Which TWO of the following are core components of a mature GitOps-based DevSecOps practice?

Accepted Answer

Integrating automated security policies (like OPA) into the deployment workflow.. IaC and automated policy gates are essential to manage infrastructure safely and securely.

Answer

Using manual SSH access for emergency production troubleshooting.

Answer

Ensuring all developers have cluster-admin privileges for rapid debugging.

Answer

Relying primarily on graphical user interfaces for cluster management.

Question 10

Which THREE of the following actions occur during an ArgoCD sync operation?

Accepted Answer

Comparing live state vs desired state. The controller fetches the latest from Git, compares the live state to Git (diff), and applies updates to the cluster.

Answer

Deleting all existing pods

Answer

Rebuilding the application image

Question 11

An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?

Accepted Answer

ArgoCD reverts the change to match the Git state. With self-heal enabled, ArgoCD detects the discrepancy between the live state and Git state and automatically overwrites the live state with the Git version.

Answer

The change is permanently accepted

Answer

ArgoCD flags the app as 'OutOfSync' but waits for manual intervention

Answer

The manual change is merged into Git

Question 12

Which TWO of the following are valid reasons to maintain a clear separation between the CI pipeline and the GitOps controller?

Accepted Answer

GitOps provides a continuous feedback loop and reconciliation that a one-time CI execution cannot offer.. Separation of concerns ensures that the build pipeline focuses on artifacts and the GitOps controller focuses on state reconciliation, which also improves security by limiting cluster access.

Answer

The GitOps controller is required to perform binary compilation of source code.

Answer

Separation allows developers to bypass the Git repository when hotfixing production.

Answer

The CI pipeline is physically incapable of deploying resources to a cluster.

Question 13

You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?

Accepted Answer

ArgoCD App Details event log. The 'App Details' view under the 'Sync' tab or the 'Events' log in the ArgoCD UI provides specific error messages regarding API connectivity and reconciliation failures.

Answer

Project settings

Answer

ApplicationSet controller logs

Answer

Git repository webhooks

Question 14

When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?

Accepted Answer

kyverno apply. The 'kyverno apply' command allows testing a policy against a local manifest to verify compliance before deployment.

Answer

kubectl get policies

Answer

kyverno test

Answer

kubectl describe policy

Question 15

You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?

Accepted Answer

Sealed Secrets controller. The Sealed Secrets controller running in the target cluster holds the private key required to decrypt the SealedSecret into a standard Kubernetes Secret.

Answer

GitOps CLI (kubeseal)

Answer

Kubernetes API Server

Answer

ArgoCD Application controller